f1ba85f0e2691849c2e79bc08e24a879ec6c4c39bcfc426b37e168472ba6ff77

Analysis

Target
emotet_exe_e5_f1ba85f0e2691849c2e79bc08e24a879ec6c4c39bcfc426b37e168472ba6ff77_2022-01-26__074832.dll
Size 784KB
Sample220126-jnn52aafcj
SHA256 f1ba85f0e2691849c2e79bc08e24a879ec6c4c39bcfc426b37e168472ba6ff77
MD5 b1715562921c251f31085138be9d48f3
SHA1 b97fb598e44747cbdb7ee9cf231e423fde831d8a
SHA512 c0b910e45ad419722b578099acc75c59d29243e8f5b42622bf336b34e8523a9cb750ac4f9e7b78afba3c86938978fcdac26e4b60c3761e65f0b4335a48cff6da
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2116	2680	regsvr32.exe	68
PID 2680 wrote to memory of 2116	2680	regsvr32.exe	68
PID 2680 wrote to memory of 2116	2680	regsvr32.exe	68
PID 2116 wrote to memory of 3140	2116	regsvr32.exe	69
PID 2116 wrote to memory of 3140	2116	regsvr32.exe	69
PID 2116 wrote to memory of 3140	2116	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f1ba85f0e2691849c2e79bc08e24a879ec6c4c39bcfc426b37e168472ba6ff77_2022-01-26__074832.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f1ba85f0e2691849c2e79bc08e24a879ec6c4c39bcfc426b37e168472ba6ff77_2022-01-26__074832.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f1ba85f0e2691849c2e79bc08e24a879ec6c4c39bcfc426b37e168472ba6ff77_2022-01-26__074832.dll",DllRegisterServer
    3⤵
    PID:3140